Analysis: "Substantive policy changes like these are clearly a job for Congress."

Share this story

The old adage, "it's best not to ask how laws and sausages are made," doesn't apply here. Consider that the US surveillance state was greatly expanded, and yet not a single member of Congress voted for the Justice Department's proposal last week.

That's because of a quirk in US law that allows so-called "procedural rules" of court to be written by unelected advisory committees under the umbrella of the Administrative Office of the US Courts. From there, they are generally rubber stamped by the Supreme Court. The only way these rules don't become law is if Congress takes action to thwart them.

So what happened here? The Federal Rule of Criminal Procedure was amended to allow judges to sign warrants to allow the authorities to hack into computers outside a judge's jurisdiction as part of a criminal investigation. What's more, Rule 41 would allow judges to use one warrant to search multiple computers anywhere instead of having to get warrants for each computer. Without Rule 41, judges could authorize electronic searches only within their own judicial district. Although this is an amendment to courthouse procedure rules, it has a huge impact in practice and on the Fourth Amendment. The Justice Department even said so as early as last week.

Consider that evidence was suppressed in two child pornography prosecutions recently because a magistrate in Virginia authorized the FBI to seize and operate Playpen, a Tor-hidden site, for 13 days. Investigators also deployed malware that disrupted Tor's privacy protections and revealed more than 1,000 true IP addresses, which led to 137 prosecutions nationwide. Other prosecutions are likely jeopardized, too. Rule 41 (PDF) cures that. What this means is that innocent individuals, even those overseas, can be caught in a government search dragnet, and the usual requirement that a warrant say with particularity who and what the authorities are searching for is out the door. And the rule that the government provide the target with a notice that a search took place presents new challenges.

Peter Carr, a Justice Department spokesman, told Ars last week that the government wants judges to have Rule 41 powers "to ensure that criminals using sophisticated anonymizing technologies to conceal their identities while they engage in crime over the Internet are able to be identified and apprehended."

But none of this was approved by Congress. Instead, the amended Rule 41 was approved (PDF) by a committee of federal judges, practicing lawyers, law professors, state chief justices, and Department of Justice representatives—and signed by the Supreme Court last week. Unless Congress rejects or alters the amended Rule 41 by December 1, it becomes the law of the land. And if Congress does nothing—and it's an election season—it also becomes the law. What's more, given that the Supreme Court already signed off on Rule 41, it's unlikely the high court would overturn it during a legal challenge.

Rule 41 is, beyond a shadow of a doubt, a massive expansion of the surveillance state. Yet Congress wasn't even a participant. And voters can't vote out the Supreme Court or the federal bureaucracy. That's why Congress should put this on its agenda and vote this up or down before the December 1 deadline, activists say.

"The Supreme Court's approval is only the final step in an esoteric process that left little room for public discussion or debate. Increased scrutiny would have demonstrated that the rule will not only potentially, but quite probably, have a substantive impact on the question of government hacking, an activity that Congress has never actually authorized. Now, the only way to stop the Rule change from taking effect is if Congress expressly acts to halt or amend it. This is not the way laws are made and is clearly a power grab by the Department of Justice and the Courts," Amie Stepanovich, a policy manager for Access Now, told Ars in an e-mail.

Ed Black, the president of the Computer & Communications Industry Association, said in a statement that the rule change was a "substantive expansion of government hacking powers" premised on a "behind-the-scenes rule change."

At least one senator thinks so, too. Ron Wyden, a Democrat of Oregon, said he would introduce legislation to upend the amendment.

“Under the proposed rules, the government would now be able to obtain a single warrant to access and search thousands or millions of computers at once; and the vast majority of the affected computers would belong to the victims, not the perpetrators, of a cybercrime," Wyden said in a statement. "These are complex issues involving privacy, digital security and our Fourth Amendment rights, which require thoughtful debate and public vetting. Substantive policy changes like these are clearly a job for Congress, the American people and their elected representatives, not an obscure bureaucratic process.”

Share this story

David Kravets
The senior editor for Ars Technica. Founder of TYDN fake news site. Technologist. Political scientist. Humorist. Dad of two boys. Been doing journalism for so long I remember manual typewriters with real paper. Emaildavid.kravets@arstechnica.com//Twitter@dmkravets